Search is waiting for input for Threat subtypes, Threat Sev and Incident Investigation

[davey1020]

Hi all,

Seem to not be getting much except Network Incidents Per Hour with new Splunk 7 install and New Palo Alto Networks App and Add-on.

When I click on 'Open in Search' I get 'undefined' in the search window. Any ideas what I may be missing? Everything installed stock. Firewalls sysloging directly to Spunk UDP 520, see different logs for traffic, threat, system on the search page.

Thanks for any ideas folks may have,

[btorresgil · Accepted solution]

Hello, which panels are not populating that you expect to populate? If you're only sending Firewall/Panorama logs with types of traffic, threat, and system, then in the new 'All Incidents' dashboard you would only see "Network Incidents Per Hour". The other 'per hour' trend graphs are populated by other products or logs and you'll need these to see these incidents.

For more information, click the tooltip next to the dashboard's title, then click 'More...' Or see the dashboard's documentation here:
https://splunk.paloaltonetworks.com/dashboards.html#incidents

[davey1020]

Thanks for the insight on the dashboards. Much appreciated.